Add host correlation and assurance coverage

docs/RUNBOOKS.md

@@ -44,6 +44,29 @@ Then pick the runbook below that matches the signature.
 
 ---
 
+## Correlation Alerts
+
+**Triggers:** `correlation.multi_stage_intrusion` (sid 100080).
+
+Correlation alerts are not separate raw telemetry. They mean one incident now
+contains multiple lower-level signals that form a stronger story, such as a
+web/database service spawning an interpreter and the same incident showing
+suspicious egress or an unusual listener inside the correlation window.
+
+- Treat the correlated incident severity as the investigation priority.
+- Keep reviewing the underlying raw alerts; they remain in the incident
+  timeline and snapshots.
+- Export the incident before containment:
+
+  ```bash
+  enodia-sentinel incident export <incident-id> > /tmp/<incident-id>.json
+  ```
+
+- If the correlation involves a web/database parent, preserve service logs,
+  access logs, and application deployment state before restarting the service.
+
+---
+
 ## Runbook 1 — Reverse shell / suspicious egress
 
 **Triggers:** `reverse_shell` (sid 100010), `egress` (sid 100016),
@@ -359,9 +382,13 @@ suspicious case.
 
 - Keep the evidence bundle; do not delete snapshots while an investigation is open
   (retention is bounded by `max_snapshots` / `max_snapshot_age_days`).
+- Preserve `hash-chain.jsonl` with the snapshots. The chain records the local
+  digest sequence for snapshot logs, snapshot JSON, and `events.log`; a missing
+  or broken chain is not proof of compromise by itself, but it is a reason to
+  distrust local evidence and compare with off-box copies.
 - Re-baseline (`baseline`, `fim-update`) only once the host is confirmed clean —
   baselining a compromised host blesses the compromise.
 - Re-run `enodia-sentinel posture check` to close the hygiene gaps that enabled
   the intrusion.
-- The incident-grouping commands (`incident show/export`) on the
-  [roadmap](ROADMAP.md) will eventually automate the evidence-bundle steps above.
+- Use `enodia-sentinel incident show/export` and the saved response plan as the
+  durable handoff record for later review.